Traffic guarantee method and device for application aware network, equipment, storage medium and product

Abstract

The invention discloses a traffic guarantee method and device for an application aware network, equipment, a storage medium and a product. The method comprises: a control device obtaining user information of an ARN service, the user information being generated based on a user-side ARN identifier of a user subscribing to the ARN service and being used for indicating a corresponding relationship between the user-side ARN identifier and a traffic identifier of a traffic of a guaranteed service; determining a network side ARN identifier corresponding to the ARN service of the service flow based on the user information and network service information providing the network service; and sending the traffic identifier and the network side ARN identifier to a corresponding network edge device. Thus, the corresponding network edge device can obtain the traffic identifier of the ARN service and the network side ARN identifier, the traffic data returned from the server side in the ARN service can be identified based on the traffic identifier, and the service performance of the returned traffic data is guaranteed based on the network side ARN identifier.

Description

Technical Field

[0001] The present application relates to the field of network services, and in particular to a method, device, equipment, storage medium and product for ensuring traffic of an application-responsive network (ARN). Background Art

[0002] Application-aware network (also known as application response network, ARN for short) technology is an end-to-end traffic differentiation guarantee solution based on network capabilities. ARN provides a model for programming differentiated service capabilities on the data plane, and provides an API (application programming interface) on the data plane similar to the application calling network capabilities in software programming. It also solves a series of problems such as privacy, security, maintainability, scalability and compatibility of existing technologies by decoupling from network Underlay resources, addresses and service levels, and realizes the ability of applications to actively call network capabilities rather than network-aware applications.

[0003] In related technologies, the ARN solution relies on the source and server to carry identifiers. When deploying ARN, it is inevitable that traffic needs to cross operators, cross borders, and access third-party services. In this case, it is difficult to connect the end-to-end industry, resulting in difficulty in guaranteeing traffic services flowing back from the server to the source. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a traffic assurance method, apparatus, device, storage medium and product for an application-aware network, which aims to ensure the service performance of traffic data flowing back from the server end in the ARN service.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a method for ensuring traffic in an application-aware network, which is applied to a control device, and the method includes:

[0007] Acquire user information of the ARN service, where the user information is generated based on a user-side ARN identifier of the ARN service subscribed by the user, and is used to indicate a correspondence between the user-side ARN identifier and a traffic identifier of a service traffic of the guaranteed service;

[0008] Determine the network-side ARN identifier corresponding to the ARN service of the business traffic based on the user information and the network service information providing the network service;

[0009] The traffic identifier and the network-side ARN identifier are sent to the corresponding network edge device.

[0010] In the above solution, the user information of the ARN service is obtained, including:

[0011] Receiving user information sent by a user device or a user-side access device; or,

[0012] Receive user information sent by the business orchestration system.

[0013] In the above solution, the determining, based on the user information and the network service information providing the network service, the network-side ARN identifier corresponding to the ARN service of the business traffic includes:

[0014] Obtain network service information that provides network services;

[0015] Based on the user information and the network service information, a network edge device providing a business service for the guaranteed business and a corresponding network-side ARN identifier are determined.

[0016] In the above scheme, the user information includes: the user-side ARN identifier, the traffic identifier and the service type of the guaranteed service, and the network service information includes: a first information table representing the correspondence between the service type of the service and the network edge device and a second information table representing the correspondence between the ARN service on the network edge device side and the ARN identifier on the network side;

[0017] The determining, based on the user information and the network service information, a network edge device providing the business service of the guaranteed business and a corresponding network-side ARN identifier includes:

[0018] Determine, based on the service type of the guaranteed service and the first information table, a network edge device that provides a service for the guaranteed service;

[0019] The network-side ARN identifier of the network edge device is determined based on the second information table of the network edge device and the ARN service subscribed by the user.

[0020] In a second aspect, an embodiment of the present application provides a traffic assurance method for an application-aware network ARN, which is applied to a network edge device, and the method includes:

[0021] Receiving a first flow identifier and a corresponding first network-side ARN identifier from a control device;

[0022] If it is determined that the first data packet received from the external network matches the first traffic identifier, the first network side ARN identifier is encapsulated into the first data packet, and the first data packet is forwarded to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the first network side ARN identifier.

[0023] In the above solution, forwarding the first data message to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the first network side ARN identifier includes:

[0024] Determine a target routing tunnel based on a correspondence between the first network-side ARN identifier and a preset network-side ARN identifier and a routing tunnel of an internal network to which the network edge device belongs;

[0025] The first data packet is forwarded to the target routing tunnel.

[0026] In the above scheme, the method further comprises:

[0027] If it is determined that the second data packet received from the internal network to which the network edge device belongs carries a second network side ARN identifier, the second network side ARN identifier and the second traffic identifier corresponding to the second data packet are recorded, and the source address of the second data packet is replaced with the network address of the network edge device before being sent out.

[0028] In the above scheme, the method further comprises:

[0029] If it is determined that the traffic identifier of the third data packet received from the external network matches the second traffic identifier recorded, the destination address of the third data packet is replaced with the source address, the second network side ARN identifier is encapsulated into the third data packet, and the third data packet is forwarded to the corresponding routing tunnel of the internal network based on the second network side ARN identifier.

[0030] In a third aspect, an embodiment of the present application provides a flow assurance device for an application-aware network, which is applied to a control device, and the device includes:

[0031] An acquisition module, used to acquire user information of the ARN service, wherein the user information is generated based on a user-side ARN identifier of the ARN service subscribed by the user, and is used to indicate a correspondence between the user-side ARN identifier and a traffic identifier of a service traffic of a guaranteed service;

[0032] A determination module, configured to determine a network-side ARN identifier corresponding to the ARN service of the business traffic based on the user information and the network service information providing the network service;

[0033] The sending module is used to send the traffic identifier and the network-side ARN identifier to the corresponding network edge device.

[0034] In a fourth aspect, an embodiment of the present application provides a flow assurance device for an application-aware network, which is applied to a network edge device, and the device includes:

[0035] A receiving module, used for receiving a first flow identifier and a corresponding first network-side ARN identifier from a control device;

[0036] A processing module is used to encapsulate the first network-side ARN identifier into the first data packet if it is determined that the first data packet received from the external network matches the first traffic identifier, and forward the first data packet to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the first network-side ARN identifier.

[0037] In a fifth aspect, an embodiment of the present application provides a control device, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein the processor, when used to run the computer program, executes the steps of the method described in the first aspect of the embodiment of the present application.

[0038] In a sixth aspect, an embodiment of the present application provides a network edge device, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein when the processor is used to run the computer program, the steps of the method described in the second aspect of the embodiment of the present application are executed.

[0039] In a seventh aspect, an embodiment of the present application provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any aspect of the embodiment of the present application are implemented.

[0040] In an eighth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method described in any aspect of the embodiment of the present application.

[0041] The technical solution provided in the embodiment of the present application controls the device to obtain user information of the ARN service. The user information is generated based on the user-side ARN identifier of the ARN service to which the user subscribes, and is used to indicate the correspondence between the user-side ARN identifier and the traffic identifier of the business traffic of the guaranteed business; based on the user information and the network service information providing the network service, the network-side ARN identifier corresponding to the ARN service of the business traffic is determined; the traffic identifier and the network-side ARN identifier are sent to the corresponding network edge device. In this way, the corresponding network edge device can obtain the traffic identifier and the network-side ARN identifier of the ARN service, can identify the traffic data returned from the server end in the ARN service based on the traffic identifier, and guarantee the service performance of the returned traffic data based on the network-side ARN identifier. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 Schematic diagram of the advantages of ARN design in related technologies;

[0043] Figure 2 It is a schematic diagram of the overall architecture of ARN in the related technology;

[0044] Figure 3 A flow chart of a method for ensuring flow of an application-aware network according to an embodiment of the present application;

[0045] Figure 4 A flow chart of a method for ensuring flow of an application-aware network according to another embodiment of the present application;

[0046] Figure 5 A schematic diagram of an ARN deployment scenario in an application example of the present application;

[0047] Figure 6 A schematic diagram of a scenario of ARN deployment in another application embodiment of the present application;

[0048] Figure 7 This is a schematic diagram of the structure of a flow assurance device for an application-aware network according to an embodiment of the present application;

[0049] Figure 8 This is a structural diagram of a flow assurance device for an application-aware network according to another embodiment of the present application;

[0050] Fig. 9 This is a schematic diagram of the structure of the control device of the embodiment of the present application;

[0051] Fig.10 This is a schematic diagram of the structure of a network edge device according to an embodiment of the present application. DETAILED DESCRIPTION

[0052] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0054] In the related technologies, ARN provides an innovative and smoothly compatible converged architecture for relatively separate business and network systems, provides a concise and efficient network capability interface for business and application sides, and provides application-level granular resource views and scheduling capabilities for the basic network. ARN hopes to provide applications with the ability to call the network like Windows software programming. Usually, when calling Windows underlying library functions, upper-level software needs to apply for a handle first, obtain permissions, and then use the handle as an API parameter to complete the processing of the library function. In the ARN scenario, if the user application is regarded as the upper-level software and the network capability is regarded as an encapsulated underlying library function, the ARN ID (ARN identifier) ​​is similar to the software handle. After the user obtains the calling permission by applying for an ARN ID, the ARN ID can be carried in the message to realize the call of the network capability.

[0055] like Figure 1 As shown in the figure, the design of ARN has the following advantages:

[0056] 1) Network and business separation

[0057] ARN encapsulates network capabilities and opens them to the outside world. It selects network tunnels / slices on the network side based on ARN ID, separates network services from business services, and provides application-level granular scheduling capabilities for the basic network.

[0058] 2) Privacy

[0059] ARN scheduling of network services based on ARN ID can avoid exposing privacy information such as network tunnels / slices, while hiding user application privacy.

[0060] 3) Scalability

[0061] ARN can be aggregated, supporting ultra-large-scale deployment and strong scalability.

[0062] 4) Security

[0063] ARN supports access control and lifecycle management. It can also report loss and reissue network services subscribed by users, and has strong security.

[0064] 5) Compatibility

[0065] When user services do not support ARN, normal forwarding is not affected, and the compatibility is strong.

[0066] 6) Application innovation

[0067] ARN supports any future application, and the basic network does not need to change with the application.

[0068] 7) Cross-domain

[0069] ARN supports cross-domain network and interconnected computing networks.

[0070] 8) QoS Orthogonality

[0071] ARN can be used with QoS (Quality of service) to implement network resource scheduling and allocation.

[0072] Figure 2 The overall architecture diagram of ARN is shown in Figure 2 The overall architecture of ARN includes: network controller, user edge devices and network edge devices in each network domain, which are set between user devices and cloud service devices. The network controller is responsible for managing ARN on the control plane, and the network edge device is responsible for providing ARN services based on ARN ID on the forwarding plane.

[0073] Specifically, the network controller compiles a service list of ARN services that can be subscribed by users based on the existing network capabilities. Users can subscribe to the required business assurance service items, that is, select ARN services with different network service levels. When the user determines the required service, the network controller will generate a user-side ARN identifier and map it with the network-side ARN identifier corresponding to the actual network resource to ensure that the user's customized needs can be accurately implemented on the network equipment. Among them, the division of each network resource can be path planning information, for example, it can be a segment routing policy (SRPolicy), that is, each SR Policy corresponds to a network path, which can be marked with a segment routing identifier (for example, BISD (BindingSegment identification, binding segment routing identifier)).

[0074] After generating the user-side ARN identifier, the network controller sends the user-side ARN identifier to the user device or user edge device, which then marks the relevant service data and encapsulates the user-side ARN identifier in the data message for transmission. In addition, the network controller also sends the mapping relationship between the user-side ARN identifier and the network-side ARN identifier and the corresponding path planning information to the network edge device.

[0075] Next, during the data transmission process, the data message sent by the user side will carry the user side ARN identifier, and the network edge device will provide corresponding service quality assurance in ARN based on the user side ARN identifier. For example, when the network edge device receives the data message sent by the user side, it obtains the user side ARN identifier in the data message and aggregates the ARN service, that is, it maps the user side ARN identifier with the network side ARN identifier with the same network capability requirements, and provides corresponding network service assurance according to the network side ARN identifier during the forwarding process. When the data message needs to cross the network domain, the network edge device at the exit finds the network edge device of the next network domain according to the cross-domain mapping information, and converts the cross-domain ARN identifier as needed. In other words, when the data message crosses different network areas, the network side ARN identifier will be remapped to adapt to different network environments to ensure the consistency of service quality on the entire transmission path. Finally, the data message arrives at the server smoothly, and the whole process realizes seamless connection from user request to service delivery, ensuring the efficiency and reliability of the service. This process involves the interaction between users and network controllers, the roles of network devices, data transmission at the application layer, and cross-domain communication. It manages and optimizes network services by using ARN identifiers.

[0076] It should be noted that in the above-mentioned cross-network domain process, it is necessary to construct the correspondence between the network-side ARN identifiers of the same security services in different network domains. For example, the ARN cross-domain coordinator can be responsible for constructing the correspondence between the network-side ARN identifiers of the same security services in different domains, such as the mapping relationship between the metropolitan area network ARN identifier and the backbone network ARN identifier. This mapping relationship can be sent to the network edge device through the network controller, thereby realizing service aggregation between different network domains (that is, the mapping between network-side ARN identifiers), so that the network-side ARN identifier will be remapped to adapt to the network environment of different network domains, ensuring the consistency of service quality on the entire transmission path.

[0077] It should be noted that the ARN solution relies on the source (i.e., the requesting end) and the server to carry the ARN identifier. However, in actual applications, there are often situations where the server crosses operators, crosses borders, and accesses third-party services, which makes it difficult to connect the industries involved in the content source side. The data packets flowing back from the server to the source are difficult to carry the relevant ARN identifier, making it difficult to guarantee the traffic service from the server to the source.

[0078] Based on this, in various embodiments of the present application, a traffic assurance method for an application-aware network is provided, which aims to ensure the service performance of traffic data flowing back from the server end in the ARN service.

[0079] The present application embodiment provides a method for ensuring traffic flow in an application-aware network, which is applied to a control device. The control device can be understood as Figure 2 The network controller shown, such as Figure 3 As shown, the method includes:

[0080] Step 301, obtaining user information of the ARN service, wherein the user information is generated based on a user-side ARN identifier of the ARN service subscribed by the user, and is used to indicate a correspondence between the user-side ARN identifier and a traffic identifier of a service traffic of a guaranteed service.

[0081] Here, since users have various demands for network services, ARN services can provide network services of multiple service levels, such as low-latency network services and high-bandwidth network services. Each category of network services can be subdivided based on the service level, which is not specifically limited here.

[0082] It is understandable that the user can subscribe to the ARN service based on the control device, and then obtain the user-side ARN identifier corresponding to the subscribed ARN service. The user-side ARN identifier can be a random number generated by the control device based on the user's subscription request, which serves as the unique identifier for the user to call the subscribed ARN service without exposing the user's privacy information. After the user obtains the user-side ARN identifier, it can be assigned to the service that needs to be protected. Based on this, the user information of the ARN service obtained by the control device needs to indicate the correspondence between the user-side ARN identifier and the traffic identifier of the service traffic of the protected service, thereby clarifying the service traffic corresponding to the ARN service.

[0083] Step 302: Determine the network-side ARN identifier corresponding to the ARN service of the business traffic based on the user information and the network service information providing the network service.

[0084] Here, after the control device obtains the user information, it needs to determine the network-side ARN identifier corresponding to the ARN service of the service traffic of the guaranteed service based on the user information and the network service information maintained by itself.

[0085] Step 303: Send the traffic identifier and the network-side ARN identifier to the corresponding network edge device.

[0086] Here, the control device sends the flow identifier and the network side ARN identifier to the corresponding network edge device based on the determined network side ARN identifier corresponding to the flow identifier. In this way, the corresponding network edge device can obtain the flow identifier and the network side ARN identifier of the ARN service, and can identify the flow data returned from the service end in the ARN service based on the flow identifier, and guarantee the service performance of the returned flow data based on the network side ARN identifier.

[0087] Exemplarily, the obtaining of user information of the ARN service includes:

[0088] Receiving user information sent by a user device or a user-side access device; or,

[0089] Receive user information sent by the business orchestration system.

[0090] In an application example, a control device may receive user information sent by a user device or a user-side access device. For example, when a user device or a user-side access device sends a data packet requesting a service, if a user-side ARN identifier is assigned in the data packet, the user device or the user-side access device may generate user information based on the traffic identifier of the service request and the user-side ARN identifier and report the information to the control device, thereby realizing one-by-one reporting of user information.

[0091] In another application example, the service orchestration system can collect the user-side ARN identifier assigned to each user, and then collect the user information of each user under the service, and uniformly send the user information corresponding to the service to the control device. In this way, the centralized sending of user information can be achieved, reducing the data interaction between user devices or user-side access devices and control devices, thereby saving network resource consumption.

[0092] Exemplarily, the determining, based on the user information and the network service information providing the network service, the network-side ARN identifier corresponding to the ARN service of the service traffic includes:

[0093] Obtain network service information that provides network services;

[0094] Based on the user information and the network service information, a network edge device providing a business service for the guaranteed business and a corresponding network-side ARN identifier are determined.

[0095] Here, the network service information providing the network service may be the network service information pre-maintained by the control device, for example, the network-side ARN identifier corresponding to each ARN service in different network domains and the network edge device corresponding to each business service.

[0096] Here, the control device can search the network service information based on user information, select the network edge device and the corresponding network side ARN identifier of the business service of the guaranteed business, and then only send the traffic identifier and network side ARN identifier to the selected network edge device, thereby effectively controlling the scope of information dissemination and reducing the network burden.

[0097] Exemplarily, the user information includes: the user-side ARN identifier, the traffic identifier, and the service type of the guaranteed service, and the network service information includes: a first information table characterizing the correspondence between the service type of the service and the network edge device, and a second information table characterizing the correspondence between the ARN service on the network edge device side and the ARN identifier on the network side;

[0098] The determining, based on the user information and the network service information, a network edge device providing the business service of the guaranteed business and a corresponding network-side ARN identifier includes:

[0099] Determine, based on the service type of the guaranteed service and the first information table, a network edge device that provides a service for the guaranteed service;

[0100] The network-side ARN identifier of the network edge device is determined based on the second information table of the network edge device and the ARN service subscribed by the user.

[0101] Here, the control device can search in the first information table based on the service type of the guaranteed service, select the network edge device that provides the service of the guaranteed service, and then search the network side ARN identifier of the user side ARN identifier in the network domain of the selected network edge device based on the second information table, that is, determine the network side ARN identifier of the user-subscribed ARN service in the network edge device, and then send the traffic identifier of the service traffic of the guaranteed service and the corresponding network side ARN identifier to the selected network edge device. The network edge device that receives the traffic identifier and the network side ARN identifier can identify the traffic data returned from the server end in the ARN service based on the traffic identifier, and guarantee the service performance of the returned traffic data based on the network side ARN identifier.

[0102] Exemplarily, the present application embodiment provides a method for ensuring traffic flow in an application-aware network, which is applied to a network edge device, such as Figure 4 As shown, the method includes:

[0103] Step 401: Receive a first flow identifier and a corresponding first network-side ARN identifier from a control device.

[0104] Step 402: If it is determined that the first data packet received from the external network matches the first traffic identifier, the first network side ARN identifier is encapsulated into the first data packet, and the first data packet is forwarded to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the first network side ARN identifier.

[0105] Here, after receiving the first traffic identifier of the business traffic that needs ARN service protection and the corresponding first network side ARN identifier issued by the control device, the network edge device can identify the first data packet returning from the server end in the ARN service based on the first traffic identifier, encapsulate the first network side ARN identifier into the first data packet, and forward the first data packet to the corresponding routing tunnel of the internal network to which the network edge device belongs, thereby ensuring the service performance of the returning traffic data.

[0106] Exemplarily, forwarding the first data message to a corresponding routing tunnel of an internal network to which a network edge device belongs based on the first network-side ARN identifier includes:

[0107] Determine the target routing tunnel based on the correspondence between the first network side ARN identifier and the preset network side ARN identifier and the routing tunnel of the internal network to which the network edge device belongs;

[0108] The first data packet is forwarded to the target routing tunnel.

[0109] Here, the network edge device side maintains a correspondence between the network side ARN identifier and the routing tunnel of the internal network to which it belongs, for example, maintains a mapping relationship between the network side ARN identifier and BISD. In this way, the target routing tunnel can be determined based on the first network side ARN identifier and the correspondence, and then the first data packet can be forwarded to the target routing tunnel to provide ARN network services for the internal network to which it belongs.

[0110] Exemplarily, the method further includes:

[0111] If it is determined that the second data packet received from the internal network carries a second network side ARN identifier, the second network side ARN identifier and the second traffic identifier corresponding to the second data packet are recorded, and the source address of the second data packet is replaced with the network address of the network edge device before being sent out.

[0112] Here, the network edge device can also detect the second data packet from the internal network. If it is determined that the second data packet carries a network side ARN identifier, for example, a second network side ARN identifier, then the second network side ARN identifier and the second traffic identifier corresponding to the second data packet are recorded, and the source address of the second data packet is replaced with the network address of the network edge device before being sent out. In this way, the source address replacement can ensure that the return traffic can still enter the internal network to which the network edge device belongs from the network edge device.

[0113] Exemplarily, the method further includes:

[0114] If it is determined that the traffic identifier of the third data packet received from the external network matches the second traffic identifier recorded, the destination address of the third data packet is replaced with the source address, the second network side ARN identifier is encapsulated into the third data packet, and the third data packet is forwarded to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the second network side ARN identifier.

[0115] It can be understood that the network edge device can also detect the third data packet from the external network. If it is determined that the traffic identifier of the third data packet matches the recorded second traffic identifier, the third data packet is determined to be the traffic data of the second data packet returning, and the destination address of the third data packet is replaced with the source address of the second data packet. The recorded second network side ARN identifier is encapsulated into the third data packet, and the third data packet is forwarded to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the second network side ARN identifier, thereby ensuring the service performance of the traffic data returning from the server in the ARN service.

[0116] The present application is further described in detail below in conjunction with application examples.

[0117] Application Example 1

[0118] In this application embodiment, the network controller sends the correspondence between the network-side ARN identifier and the traffic identifier of the guaranteed service to the network edge device, thereby ensuring the traffic service performance from the content source to the user.

[0119] like Figure 5 As shown, the network controller can manage and control the internal network of the service provider. The method of this application embodiment specifically includes:

[0120] 1) After the user-side access device allocates an ARN ID to the user, it uploads the correspondence between the user and the ARN ID to the network controller;

[0121] Here, the user-side access device can receive the user-side ARN identifier issued by the network controller. The user-side ARN identifier corresponds to the ARN service subscribed by the user. After the user-side access device assigns the user-side ARN identifier to the service that needs to be guaranteed, it can generate user information and upload it to the network controller.

[0122] For example, the user information is shown in Table 1 below:

[0123] Table 1

[0124]

[0125] The traffic five-tuple information is the traffic identifier, and the policy information is used to indicate the network path corresponding to the ARN service. It is understandable that based on the user information, the network controller can maintain information such as the user, the user-side ARN identifier assigned to the user, the guaranteed service type, and the service traffic that needs to be guaranteed.

[0126] It should be noted that the network controller also maintains network service information, which includes: a first information table representing the correspondence between the business type of the business service and the network edge device, and a second information table representing the correspondence between the ARN service on the network edge device side and the ARN identifier on the network side.

[0127] Exemplarily, the format of the first information table is shown in Table 2 below:

[0128] Table 2

[0129] Border router IP address Service Category Service sub-category 10.1.1.1 Games Game A

[0130] It can be understood that the network controller can select a matching network edge device (i.e., border router) in the first information table based on the protected service type in the user information, and the network controller further selects the network-side ARN identifier corresponding to the matching network edge device based on the second information table and the ARN ID in the user information.

[0131] 2) The network controller binds the user information with the traffic five-tuple information of the service traffic to be guaranteed and sends it to the relevant network edge devices;

[0132] Here, the network controller can send the traffic quintuple information and the corresponding network-side ARN identifier to the aforementioned determined network edge device based on the aforementioned determined network edge device. For example, the network controller determines that the matching network edge devices are PE2 and PE4 based on the guarantee service of game A, and sends the traffic quintuple information and the corresponding network-side ARN identifier to PE2 and PE4.

[0133] 3) The network edge device receives and stores the traffic five-tuple information and the corresponding network side ARN identifier and other information sent by the network controller;

[0134] 4) After receiving external traffic, the network edge device identifies the five-tuple information of the traffic. If it is determined to be matching business traffic, the network-side ARN identifier is encapsulated into the data message and the data message is forwarded according to the security requirements.

[0135] Application Example 2

[0136] In this application embodiment, the network edge device records the message data after receiving it, and then replaces the source address to ensure that the traffic still enters the internal network from the network edge device, thereby providing ARN service guarantee for the return traffic.

[0137] like Figure 6 As shown, the network controller can manage and control the internal network of the service provider. The method of this application embodiment specifically includes:

[0138] 1) When a data packet accesses a content source from the user side, if the data packet enters the external network from the PE2 device as an egress, the PE2 device checks whether the data packet carries the ARN ID. If so, the PE2 device records the ARN ID and traffic identifier of the data packet.

[0139] Exemplarily, the information recorded by the network edge device is shown in Table 3 below:

[0140] Table 3

[0141]

[0142] 2) PE2 changes the source address of the traffic to the local address of the device, and then forwards the message to other networks;

[0143] 3) When the PE2 device receives a data message from the external network, it searches for locally stored information, replaces the destination address of the data message with the address of the initial user, encapsulates the corresponding ARN ID into the data message, and forwards the data message to the internal network device.

[0144] It can be understood that the network edge device can ensure that the return traffic still enters the internal network from the network edge device based on the source address replacement, and then provide ARN service for the return traffic based on the recorded ARN ID to ensure the service performance of the return traffic.

[0145] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a flow assurance device for an application-aware network, which corresponds to the flow assurance method for the application-aware network on the control device side mentioned above, and each step in the embodiment of the flow assurance method for the application-aware network on the control device side mentioned above is also fully applicable to the embodiment of the flow assurance device for the application-aware network.

[0146] like Figure 7As shown, the flow assurance device of the application-aware network includes: an acquisition module 701, a determination module 702 and a sending module 703. The acquisition module 701 is used to acquire user information of the ARN service, and the user information is generated based on the user-side ARN identifier of the ARN service subscribed by the user, and is used to indicate the correspondence between the user-side ARN identifier and the flow identifier of the service flow of the guaranteed service; the determination module 702 is used to determine the network-side ARN identifier corresponding to the ARN service of the service flow based on the user information and the network service information providing the network service; the sending module 703 is used to send the flow identifier and the network-side ARN identifier to the corresponding network edge device.

[0147] Exemplarily, the acquisition module 701 is specifically used for:

[0148] Receiving user information sent by a user device or a user-side access device; or,

[0149] Receive user information sent by the business orchestration system.

[0150] Exemplarily, the determination module 702 is specifically configured to:

[0151] Obtain network service information that provides network services;

[0152] Based on the user information and the network service information, a network edge device providing a business service for the guaranteed business and a corresponding network-side ARN identifier are determined.

[0153] Exemplarily, the user information includes: the user-side ARN identifier, the traffic identifier, and the service type of the guaranteed service, and the network service information includes: a first information table characterizing the correspondence between the service type of the service and the network edge device, and a second information table characterizing the correspondence between the ARN service on the network edge device side and the ARN identifier on the network side;

[0154] The determination module 702 is specifically used for:

[0155] Determine, based on the service type of the guaranteed service and the first information table, a network edge device that provides a service for the guaranteed service;

[0156] The network-side ARN identifier of the network edge device is determined based on the second information table of the network edge device and the ARN service subscribed by the user.

[0157] In actual application, the acquisition module 701, the determination module 702 and the sending module 703 can be implemented by a processor in the control device. Of course, the processor needs to run the computer program in the memory to implement its functions.

[0158] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a traffic assurance device for an application-aware network, which corresponds to the traffic assurance method for the application-aware network on the network edge device side mentioned above, and each step in the embodiment of the traffic assurance method for the application-aware network on the network edge device side mentioned above is also fully applicable to the embodiment of the traffic assurance device for the application-aware network.

[0159] like Figure 8 As shown, the flow assurance device of the application-aware network includes: a receiving module 801 and a processing module 802. The receiving module 801 is used to receive a first flow identifier and a corresponding first network-side ARN identifier from a control device; the processing module 802 is used to encapsulate the first network-side ARN identifier into the first data message if it is determined that the first data message received from the external network matches the first flow identifier, and forward the first data message to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the first network-side ARN identifier.

[0160] Exemplarily, the processing module 802 is specifically configured to:

[0161] Determine the target routing tunnel based on the correspondence between the first network side ARN identifier and the preset network side ARN identifier and the routing tunnel of the internal network to which the network edge device belongs;

[0162] The first data packet is forwarded to the target routing tunnel.

[0163] Exemplarily, the processing module 802 is further configured to:

[0164] If it is determined that the second data packet received from the internal network carries the second network side ARN identifier, the second network side ARN identifier and the second traffic identifier corresponding to the second data packet are recorded, and the source address of the second data packet is replaced with the network address of the network edge device before being sent out.

[0165] Exemplarily, the processing module 802 is further configured to:

[0166] If it is determined that the traffic identifier of the third data packet received from the external network matches the second traffic identifier recorded, the destination address of the third data packet is replaced with the source address, the second network side ARN identifier is encapsulated into the third data packet, and the third data packet is forwarded to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the second network side ARN identifier.

[0167] In actual application, the receiving module 801 and the processing module 802 can be implemented by a processor in the network edge device. Of course, the processor needs to run the computer program in the memory to implement its function.

[0168] It should be noted that: the flow assurance device for the application-aware network provided in the above embodiment only uses the division of the above program modules as an example when performing flow assurance for the application-aware network. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the flow assurance device for the application-aware network provided in the above embodiment and the flow assurance method embodiment for the application-aware network belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0169] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a control device. Fig. 9 Only an exemplary structure of the control device is shown, not all structures, and can be implemented as needed. Fig. 9 Partial or complete structure shown.

[0170] like Fig. 9 As shown, the control device 900 provided in the embodiment of the present application includes: at least one processor 901, a memory 902, a user interface 903 and at least one network interface 904. The various components in the control device 900 are coupled together through a bus system 905. It can be understood that the bus system 905 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 905 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, in Fig. 9 Various buses are labeled as bus system 905.

[0171] The user interface 903 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0172] The memory 902 in the embodiment of the present application is used to store various types of data to support the operation of the control device. Examples of such data include: any computer program used to operate on the control device.

[0173] The flow assurance method of the application-aware network disclosed in the embodiment of the present application can be applied to the processor 901, or implemented by the processor 901. The processor 901 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the flow assurance method of the application-aware network can be completed by the hardware integrated logic circuit or software instructions in the processor 901. The above-mentioned processor 901 may be a general-purpose processor, a digital signal processor (DSP, DigitalSignal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 901 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 902, and the processor 901 reads the information in the memory 902, and completes the steps of the flow assurance method of the application-aware network provided in the embodiment of the present application in combination with its hardware.

[0174] In an exemplary embodiment, the control device 900 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0175] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a network edge device. Fig.10 Only an exemplary structure of the network edge device is shown, not all structures, and can be implemented as needed. Fig.10 Partial or complete structure shown.

[0176] like Fig.10As shown, the network edge device 1000 provided in the embodiment of the present application includes: at least one processor 1001, a memory 1002, a user interface 1003 and at least one network interface 1004. The various components in the network edge device 1000 are coupled together through a bus system 1005. It can be understood that the bus system 1005 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1005 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Fig.10 Various buses are labeled as bus system 1005 .

[0177] The user interface 1003 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0178] The memory 1002 in the embodiment of the present application is used to store various types of data to support the operation of the network edge device. Examples of such data include: any computer program used to operate on the network edge device.

[0179] The flow assurance method of the application-aware network disclosed in the embodiment of the present application can be applied to the processor 1001, or implemented by the processor 1001. The processor 1001 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the flow assurance method of the application-aware network can be completed by the hardware integrated logic circuit or software instructions in the processor 1001. The above-mentioned processor 1001 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 1001 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 1002. The processor 1001 reads the information in the memory 1002 and, in combination with its hardware, completes the steps of the traffic assurance method for the application-aware network provided in the embodiment of the present application.

[0180] In an exemplary embodiment, the network edge device 1000 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0181] It can be understood that the memory 902, 1002 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0182] In an exemplary embodiment, the embodiment of the present application further provides a computer storage medium, which can be a computer-readable storage medium, for example, a memory 902 storing a computer program, which can be executed by a processor 901 of a control device 900 to complete the steps described in the method of the embodiment of the present application; for another example, a memory 1002 storing a computer program can be executed by a processor 1001 of a network edge device 1000 to complete the steps described in the method of the embodiment of the present application. The computer-readable storage medium can be a memory such as a ROM, a PROM, an EPROM, an EEPROM, a FlashMemory, a magnetic surface memory, an optical disk, or a CD-ROM.

[0183] In an exemplary embodiment, the embodiment of the present application also provides a computer program product, including a computer program, which can be executed by the processor 901 of the control device 900 or by the processor 1001 of the network edge device 1000 to complete the steps described in the method of the embodiment of the present application.

[0184] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0185] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0186] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for ensuring traffic flow of an application-aware network ARN, characterized in that: Applied to a control device, the method comprises: Acquire user information of the ARN service, where the user information is generated based on a user-side ARN identifier of the ARN service subscribed by the user, and is used to indicate a correspondence between the user-side ARN identifier and a traffic identifier of a service traffic of the guaranteed service; Determine the network-side ARN identifier corresponding to the ARN service of the business traffic based on the user information and the network service information providing the network service; The traffic identifier and the network-side ARN identifier are sent to the corresponding network edge device.

2. The method according to claim 1, characterized in that The user information of the ARN service is obtained, including: Receiving user information sent by a user device or a user-side access device; or, Receive user information sent by the business orchestration system.

3. The method according to claim 1, characterized in that The determining, based on the user information and the network service information providing the network service, the network-side ARN identifier corresponding to the ARN service of the business traffic includes: Obtain network service information that provides network services; Based on the user information and the network service information, a network edge device providing the business service of the guaranteed business and a corresponding network-side ARN identifier are determined.

4. The method according to claim 3, characterized in that The user information includes: the user-side ARN identifier, the traffic identifier, and the service type of the guaranteed service; the network service information includes: a first information table representing the correspondence between the service type of the service and the network edge device, and a second information table representing the correspondence between the ARN service on the network edge device side and the ARN identifier on the network side; The determining, based on the user information and the network service information, a network edge device providing the business service of the guaranteed business and a corresponding network-side ARN identifier includes: Determine, based on the service type of the guaranteed service and the first information table, a network edge device that provides a service for the guaranteed service; The network-side ARN identifier of the network edge device is determined based on the second information table of the network edge device and the ARN service subscribed by the user.

5. A method for ensuring traffic flow of an application-aware network ARN, characterized in that: Applied to a network edge device, the method comprises: Receiving a first flow identifier and a corresponding first network-side ARN identifier from a control device; If it is determined that the first data packet received from the external network matches the first traffic identifier, the first network side ARN identifier is encapsulated into the first data packet, and the first data packet is forwarded to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the first network side ARN identifier.

6. The method according to claim 5, characterized in that The forwarding of the first data message to a corresponding routing tunnel of the internal network to which the network edge device belongs based on the first network-side ARN identifier includes: Determine a target routing tunnel based on a correspondence between the first network-side ARN identifier and a preset network-side ARN identifier and a routing tunnel of an internal network to which the network edge device belongs; The first data packet is forwarded to the target routing tunnel.

7. The method according to claim 5, characterized in that The method further comprises: If it is determined that the second data packet received from the internal network to which the network edge device belongs carries a second network side ARN identifier, the second network side ARN identifier and the second traffic identifier corresponding to the second data packet are recorded, and the source address of the second data packet is replaced with the network address of the network edge device before being sent out.

8. The method according to claim 7, characterized in that The method further comprises: If it is determined that the traffic identifier of the third data packet received from the external network matches the second traffic identifier recorded, the destination address of the third data packet is replaced with the source address, the second network side ARN identifier is encapsulated into the third data packet, and the third data packet is forwarded to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the second network side ARN identifier.

9. A flow assurance device for an application-aware network ARN, characterized in that: Applied to a control device, the device comprises: An acquisition module, used to acquire user information of the ARN service, wherein the user information is generated based on a user-side ARN identifier of the ARN service subscribed by the user, and is used to indicate a correspondence between the user-side ARN identifier and a traffic identifier of a service traffic of a guaranteed service; A determination module, configured to determine a network-side ARN identifier corresponding to the ARN service of the business traffic based on the user information and the network service information providing the network service; The sending module is used to send the traffic identifier and the network-side ARN identifier to the corresponding network edge device.

10. A flow assurance device for an application-aware network ARN, characterized in that: Applied to a network edge device, the device comprises: A receiving module, used for receiving a first flow identifier and a corresponding first network-side ARN identifier from a control device; A processing module is used to encapsulate the first network-side ARN identifier into the first data packet if it is determined that the first data packet received from the external network matches the first traffic identifier, and forward the first data packet to the corresponding routing tunnel of the internal network to which the network edge device belongs based on the first network-side ARN identifier.

11. A control device, characterized in that: include: A processor and a memory for storing a computer program that can be executed on the processor, wherein: The processor is used to execute the steps of the method according to any one of claims 1 to 4 when running a computer program.

12. A network edge device, characterized in that: include: A processor and a memory for storing a computer program that can be executed on the processor, wherein: The processor is used to execute the steps of the method according to any one of claims 5 to 8 when running a computer program.

13. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images